Make sure to escape the url.
Sanitize text field on $_GET['code'] for paranoia.